Bitstamp Hot Wallet Hack

Notice: This page is a freshly imported case study from the original repository. The original content was in a different format, and may not have relevant information for all sections. Please help restructure the content by moving information from the 'About' section to other sections, and add any missing information or sources you can find. If you are new here, please read General Tutorial on Wikis or Anatomy of a Case Study for help getting started.

Bitstamp

Apparently the wallet file (named wallet.dat) was encrypted with only a simple passphrase, which was also stored online. This breach took down one of the largest and most widely used exchanges at the time, bringing down multiple services such as ATMs that sourced their liquidity from Bitstamp. Bitstamp has since set up multi-signature hot wallets through BitGo, while the majority of funds remain in cold storage. No customers of the exchange appear to have lost their funds in the incident.

This exchange or platform is based in Luxembourg, or the incident targeted people primarily in Luxembourg.

About Bitstamp

"Bitstamp is a cryptocurrency exchange based in Luxembourg. It allows trading between fiat currency, bitcoin and other cryptocurrencies. It allows USD, EUR, GBP, bitcoin, ALGO, XRP, Ether, litecoin, bitcoin cash, XLM, Link, OMG Network, USD Coin or PAX deposits and withdrawals." "Bitstamp makes trading easy, fast & reliable. With 24/7 support, staking and bank-grade security & insurance. Since 2011."

"The company was founded as a European-focused alternative to then-dominant bitcoin exchange Mt. Gox. While the company trades in US dollars, it accepts fiat money deposits for free only via the European Union's Single Euro Payments Area, a mechanism for transferring money between European bank accounts."

“In 2015, Bitstamp lost 19,000 BTC, which were stolen by hackers from the exchange’s hot wallet. At that time, the losses were equivalent to $5 million. Surprisingly, a banal phishing attack was used by hackers — the exchange employees received personal emails and messages in Skype from seemingly friendly sources.” “Six employees of Bitstamp were targeted in a weeks-long phishing attempt leading up to the theft of roughly $5m in bitcoin in January, according to an unconfirmed incident report said to be drafted internally by the bitcoin exchange.” "Bitstamp’s wallet system was compromised, prompting it to halt deposits and later shut down its platform entirely." “What’s maybe even more surprising is that the person responsible for security, Bitstamp system administrator Luka Kodrich, clicked the link and downloaded malware onto the working computer, after which the exchange was hacked. Bitstamp hurried to notify traders about what was happening, however, the attackers had already stolen the funds.” “On this occasion, Mr.Kodric was certain that these logins were not made by him, and must therefore have been the attacker. Analysis indicates that the attacker accessed LNXSRVBTC, where the wallet.dat file was held, and the DORNATA server, where the passphrase for the bitcoin wallet was stored, before data was transferred out to both servers to IP 1**.**.***.**8, which is part of a range owned by a German hosting provider. We suspect that the the attacker copied the Bitcoin wallet file and passphrase at this stage [...] Together the wallet and passphrase would have enabled the attacker to steal bitcoins from the Bitcoin wallet.” “all BTC held with [Bitstamp] prior to the temporary suspension of services were honored in full.” “A wallet associated with [the] $31 million Tether hack has been linked to previous bitcoin exchange thefts numbering in the tens of thousands of bitcoins.”

This exchange or platform is based in Luxembourg, or the incident targeted people primarily in Luxembourg.

The background of the exchange platform, service, or individuals involved, as it would have been seen or understood at the time of the events.

Include:

Known history of when and how the service was started.
What problems does the company or service claim to solve?
What marketing materials were used by the firm or business?
Audits performed, and excerpts that may have been included.
Business registration documents shown (fake or legitimate).
How were people recruited to participate?
Public warnings and announcements prior to the event.

Don't Include:

Any wording which directly states or implies that the business is/was illegitimate, or that a vulnerability existed.
Anything that wasn't reasonably knowable at the time of the event.

There could be more than one section here. If the same platform is involved with multiple incidents, then it can be linked to a main article page.

The Reality

This sections is included if a case involved deception or information that was unknown at the time. Examples include:

When the service was actually started (if different than the "official story").
Who actually ran a service and their own personal history.
How the service was structured behind the scenes. (For example, there was no "trading bot".)
Details of what audits reported and how vulnerabilities were missed during auditing.

What Happened

The specific events of the loss and how it came about. What actually happened to cause the loss and some of the events leading up to it.

Key Event Timeline - Bitstamp Hot Wallet Hack
Date	Event	Description
January 1st, 2015 12:00:36 AM	First Event	This is an expanded description of what happened and the impact. If multiple lines are necessary, add them here.

Total Amount Lost

The total amount lost is unknown.

How much was lost and how was it calculated? If there are conflicting reports, which are accurate and where does the discrepancy lie?

Immediate Reactions

How did the various parties involved (firm, platform, management, and/or affected individual(s)) deal with the events? Were services shut down? Were announcements made? Were groups formed?